Wegia CVE-2026-35473

The CVSS 5.1 score reflects low-to-moderate direct impact; however, the real-world risk is elevated by the practical exploitability of open redirects in social engineering and phishing campaigns. The attack vector is network-based with low complexity and no authentication requirement, making it broadly accessible. User interaction is required (victims must click a link), which reduces purely technical impact but increases the likelihood of successful real-world exploitation when combined with social engineering. The vulnerability affects an application managing charitable institutions, suggesting exposure to organizations with potential community trust relationships-a factor that increases phishing effectiveness. No EPSS score, KEV status, or public exploit code was identified in the provided data, indicating this may be a newly disclosed or lower-profile vulnerability. The absence of active exploitation signals does not diminish the practical risk, as open redirects are routinely weaponized by attackers and require minimal effort to exploit once disclosed.

An attacker crafts a malicious URL containing the vulnerable WeGIA endpoint with a nextPage parameter pointing to a phishing site (e.g., https://wegia.example.com/WeGIA/controle/control.php?metodo=listarId&nomeClasse=IentradaControle&nextPage=https://attacker-phishing-site.com). The attacker sends this URL to users of the charitable institution via email or social media, framing it as a legitimate system notification. When a user clicks the link, they are redirected to the attacker's phishing site, which mimics the trusted WeGIA login page, allowing credential harvesting or malware distribution. The presence of the legitimate WeGIA domain in the initial URL significantly increases user trust and click-through rates.